Groups and access

In Frontdoor, access works through groups: a user sees an app when one of the user's groups has permission on it. You manage groups from Groups (/admin/groups).

Roles

Each user has one of four roles. The role decides which admin pages the user can open; groups decide which apps the user sees.

Role	What it can do
owner	Everything, including Logs, Audit, Customize and backups
admin	Manage apps, groups and users, import Entra groups, run a sync, assign roles. No access to Logs, Audit and Customize
admin_readonly	View the admin pages for apps, groups and users, without changing anything
user	Use the app catalog, with personal preferences

The people listed in ADMIN_EMAILS become owners automatically when they sign in. While they stay in that list, their role cannot be changed from the web interface.

Create a local group

1. Open Groups and select New group.
2. Enter a Name and, optionally, a Description.
3. Use Add members to add users and Add apps to give the group access to apps.

You can search groups by name, by member or by app slug, and delete several groups at once. Frontdoor points out problematic groups, such as Groups without apps and Groups without members.

Use Microsoft Entra groups

When the operator enables Entra group sync (ENTRA_GROUP_SYNC=true, see Microsoft Entra setup), Frontdoor discovers each user's Entra groups when they sign in.

Discovery and import are separate steps:

1. Discovered groups wait in a cache. They grant nothing yet.
2. Open Import Entra groups, select the groups you want to use in Frontdoor and choose Import selected.
3. Imported groups behave like local groups: give them apps as usual. Their members come from Microsoft Entra.

If you delete an imported group from Frontdoor, it does not come back on its own. It must be discovered again by a sign-in or a sync, then imported again.

Sync now

Sync groups refreshes the tenant-wide group catalog and the Entra memberships of every user in one go. Run it, or wait for the next sign-in, right after you enable Entra group sync to fill the cache.

The same sync also handles people who left your organization: see Users and Entra sync.

Groups deleted in Microsoft Entra

When Microsoft Entra reports that a group was deleted, Frontdoor flags it (This group was deleted in Microsoft Entra), keeps a snapshot of its members, apps and linking groups, and notifies the admins. This applies both to imported groups and to Entra groups only linked into local groups.

With the default policy (ENTRA_DELETED_GROUP_POLICY=freeze), members keep their access until you decide. You can:

• Convert to local group: the group keeps its members and apps and stops syncing with Microsoft Entra.
• move its apps to another group
• unlink it
• delete it

With ENTRA_DELETED_GROUP_POLICY=revoke, members lose the access at their next sign-in or at the next sync. A group restored in Microsoft Entra is unflagged on its own.

Link groups together

A local group can include other groups (Linked groups): members of a linked group inherit the apps of the group that contains it. You can also link Entra groups directly (Linked Entra groups), without importing them.

Frontdoor resolves inherited access across the whole chain of links.

Transfer apps between groups

To copy or move all the direct app permissions of one group to another, open the hidden Transfer group apps page (/admin/group-transfer, reached with Transfer):

1. Pick a Source group and a Target group.
2. Choose Copy apps (the source stays unchanged) or Move apps (the permissions are removed from the source after they are added to the target).
3. Check the preview and run the transfer.

Only direct app permissions move. Members, linked groups and Entra links stay untouched, and apps inherited from linked groups are not copied.

Check what a user can see

In Users, open a user and select Visible apps to see every app the user can reach and through which group.